up vote 0 down vote favorite
share [g+] share [fb]

I have installed Endian Community Firewall 2.3 and am clearly misunderstanding/doing something wrong with it. I'm trying to create some destination NAT rules to allow incoming connections to various services within the network.

  • Router - RED I/F - x.x.x.x
  • Router - GREEN I/F - 192.168.11.253
  • ECF - RED I/F - 192.168.11.254/24
  • ECF - GREEN I/F - 192.168.12.254/24
  • Target server - 192.168.12.1

Please ignore the haphazard choice of subnets and addresses- I'm trying to quickly plop Endian into an existing network before a complete rework in 6-12 months so for now.

Everything works except destination NAT, so outgoing connections are fine, the routes between the two subnets are OK etc.

I want to create various incoming NATs but let's take for the sake of argument, SMTP port 25 from the Internet to Target server 192.168.12.1.

I've tried almost every combination of options in the Destination NAT section to achieve this and clearly am doing something wrong. I suspect my confusion must be somewhere in the Access From and/or Target section.

The rest seems OK

Filter Policy = Allow
Service = SMTP
Protocol = TCP
Port = 25
Translate to type = IP
DNAT Policy = NAT
Insert IP = 192.168.12.1
Port Range = 25
Enabled = Checked
Position = First

I can't work out what I'm doing wrong, or am I doing it right and it's just not working!?

Any help would be greatly appreciated.

link|improve this question
I hate to ask such silly questions, but is 192.168.12.1 listening on port 25. Is telnet 192.168.12.1 25 successful? – Sachin Divekar Nov 28 '11 at 12:29
It is- 220 Microsoft ESMTP MAIL service ready...- It works without Endian there perfectly fine. I've also tried NATing 192.168.11.253 25 to 192.168.12.253/254 to then NATing 12.254 to 12.1 amongst various other configurations – Ben Swinburne Nov 28 '11 at 13:29
Yet another silly question, is the FW configured to let [any]-or the source of your choice, access the external IP at port 25? – abutbul Nov 29 '11 at 16:51
The router has 192.168.12.254 set up as a host DMZ so all traffic is automatically natted to the Endian gateway. I've tried almost every combination I can find but may have missed one in this case. Perhaps if could explain in detail as an answer? – Ben Swinburne Nov 29 '11 at 17:13
Does the Endian require you have both a NAT policy to make the translations and a firewall policy to actually permit the traffic? Most firewalls I work on require this. – SpacemanSpiff Dec 2 '11 at 2:59
show 1 more comment
feedback

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
or
required, but never shown
discard

Browse other questions tagged or ask your own question.